Threats tagged 'cryptocurrency stealer'

JSCeal is a sophisticated cryptocurrency-focused stealer malware delivered as compiled V8 bytecode executed by a bundled Node.js runtime. It employs multiple layers of JavaScript obfuscation and encryption, including RC4 and AES-256-CBC, to protect its payload. The malware's capabilities include keylogging, browser credential theft, cryptocurrency collection, HTTPS traffic interception via a local man-in-the-middle proxy, and session replay using stolen cookies. Recent variants target macOS and newer V8 versions, showing active development. Check Point Research developed a fully static deobfuscation pipeline to analyze JSCeal without executing it, enabling detailed understanding of its behavior. The toolkit is publicly available and supports analysis of multiple samples.

A phishing campaign impersonates sales staff from overseas companies, sending emails with malicious GZ compressed files. Extracting these files delivers an injector executable that uses multiple UAC bypass techniques and exploits a vulnerable driver (DCRCVDrv.sys) to disable security products at the kernel level. The injector then uses process hollowing to inject PhantomStealer malware into a legitimate process. PhantomStealer steals sensitive information including keystrokes, screenshots, browser credentials, cryptocurrency wallet data, and manipulates clipboard contents to replace wallet addresses with attacker-controlled ones.

A cargo theft threat actor maintained access to a decoy environment for over a month, providing extensive visibility into post-compromise operations. The attacker established redundant persistence using multiple remote access tools, including four ScreenConnect instances, Pulseway RMM, and SimpleHelp RMM. A previously unknown signing-as-a-service capability was employed to evade detection by re-signing ScreenConnect installers with fraudulent code-signing certificates. Extensive reconnaissance targeted financial platforms, payment systems, cryptocurrency wallets, and transportation-specific services including fuel card providers, fleet payment platforms, and load board operators. The activity strongly aligns with financially motivated crimes against the transportation industry, including freight diversion and cargo theft operations.